Ley 2/2023: Spain’s whistleblowing channel for payment firms

Ley 2/2023, Spain’s whistleblower law, requires a payment or e-money firm to run an internal reporting system whatever its headcount, and that includes the Spanish branch of a firm authorised elsewhere in the EU. The 50-employee threshold most summaries quote is not the test for a firm subject to the anti-money-laundering law. These firms fall under Article 10.1.b), the sector-specific route. On top of that sits a second, older duty: the AML breach-reporting procedure in Article 26 bis of Ley 10/2010, with Sepblac as the external channel. This piece sets out both regimes and how to run them as one.

1. The texts

Three sets of rules apply, and they overlap.

• Ley 2/2023, de 20 de febrero, on the protection of persons who report regulatory breaches and on the fight against corruption. It transposes Directive (EU) 2019/1937 and has been in force since 13 March 2023.
• Ley 10/2010 on the prevention of money laundering and terrorist financing. Article 26 bis, added by Real Decreto-ley 11/2018, requires an internal procedure for reporting AML breaches. Articles 63 to 65 set up reporting to the Servicio Ejecutivo (Sepblac) and protect those who report.
• Real Decreto 1101/2024, de 29 de octubre, which approves the statute of the Autoridad Independiente de Protección del Informante, A.A.I. Under Orden PJC/908/2025, the authority has been operating since 1 September 2025.

2. Who must have a Sistema interno de información

Article 10.1 of Ley 2/2023 lists three groups of private-sector entities that must have a system:

• letter a), individuals or companies with 50 or more workers;
• letter b), entities within the scope of the EU acts on financial services, products and markets, money-laundering and terrorist-financing prevention, transport safety and environmental protection. They must have a system regardless of the number of workers. Their own sector rules govern the system, and Ley 2/2023 fills in whatever those rules leave out;
• letter c), political parties, trade unions, business organisations and their foundations that receive or manage public funds.

Payment institutions and e-money institutions are obliged entities under Article 2.1 of Ley 10/2010 and are regulated financial-services firms. Both facts place them in letter b), so a five-person Spanish payment institution is caught as firmly as a 500-person bank. Letter b) also covers entities with no registered office in Spain that operate here through branches, agents or cross-border services without a permanent establishment. For an EU payment or e-money firm passporting into Spain, the branch is therefore within scope. So, on the text, are agent and freedom-of-services models.

Because the sector rules come first, the AML channel of Article 26 bis is the specific regime, and Ley 2/2023 applies wherever it is silent. Article 26 bis says very little, so most of the working rules come from Ley 2/2023.

3. What the system must contain

The management body implements the system after consulting the workers’ legal representatives, and it is the data controller (Article 5.1). Among the ten requirements of Article 5.2, the system must:

• be open to everyone in Article 3, from employees and board members to contractors’ staff, former employees and candidates;
• be secure and protect the identity of the reporter and of any third party mentioned;
• accept written reports, verbal reports or both;
• integrate the entity’s internal channels (letter d), so the AML channel cannot run as a silo;
• have a Responsable, a published policy, a management procedure and protection guarantees.

Article 6 allows an external provider to manage the channel as data processor, but responsibility stays with the Responsable. Article 25 requires clear information on how to use the internal channel. Where the entity has a website, that information goes on the home page, in a separate section that is easy to find.

4. The Responsable del Sistema and the A.A.I. notice

Under Article 8, the management body appoints the Responsable del Sistema. The Responsable is either a natural person or a collegiate body, which must delegate the management of the system and the handling of files to one of its members. In the private sector the Responsable must be an independent manager (directivo) with adequate means; an existing compliance officer may be appointed.

Both the appointment and the dismissal must be notified within ten working days to the A.A.I. or to the competent regional authority. A dismissal must state its reasons. Only notices sent to the A.A.I. go through the official form in its electronic office (sede electrónica). Its criteria send entities with establishments in more than one autonomous community to the A.A.I., as well as those in a single community without an operational regional authority. A single-office branch should check which body is competent.

5. The procedure and its deadlines

The management body approves the management procedure, and the Responsable must handle it diligently. Article 9.2 sets the minimum content:

1. identify the internal channels it covers, and give clear information on the external channels to the competent authorities and, where relevant, EU bodies;
2. send an acknowledgement within seven calendar days of receipt, unless doing so would put confidentiality at risk;
3. reply within three months at most, extendable by up to three more months in especially complex cases;
4. allow continued contact with the reporter and requests for further information;
5. inform the person concerned of the facts alleged against them and hear them, at a moment that does not damage the investigation, while respecting the presumption of innocence and their honour;
6. train staff outside the channel who may receive a report, warn them that breaching confidentiality is a very serious infringement, and require them to pass the report straight to the Responsable;
7. refer facts that may be a crime to the Ministerio Fiscal at once, or to the European Public Prosecutor’s Office where the EU’s financial interests are affected.

Article 7 adds that a reporter may ask for a face-to-face meeting within seven days, and that anonymous reports must be accepted and handled.

6. Libro-registro, data protection and protection from retaliation

Article 26 requires every entity with an internal channel to keep a libro-registro of the reports received and the internal investigations they led to. The register is not public. A court can access it only by a reasoned order (auto) in judicial proceedings. Personal data may be kept only as long as necessary and proportionate, and never for more than ten years.

Title VI adds the data rules. The person concerned is never told who made the report (Article 31). Article 32 limits access to named roles: the Responsable, human resources only where disciplinary action may follow, legal services, processors and the data protection officer. If no investigation has started three months after receipt, the data must be deleted. The only exception is what is kept as evidence that the system works. Under Article 33, the reporter’s identity may be disclosed only to a court, the public prosecutor or the competent administrative authority in an investigation, and normally after telling the reporter.

Retaliation, including threats and attempts, is prohibited (Article 36), and protection lasts two years. Under Article 38.4, once a reporter shows they made a report and then suffered harm, the harm is presumed to be retaliation, and the employer must show otherwise. Failing to have a system that meets the law is a very serious infringement under Article 63.1.g). For a legal person, Article 65 sets the fine for a very serious infringement between EUR 600,001 and EUR 1,000,000.

7. The AML channel of Article 26 bis Ley 10/2010

Article 26 bis requires obliged entities to set up internal procedures through which employees, directors and agents can report possible breaches of Ley 10/2010, its implementing regulations or the entity’s own AML policies, including anonymously. It may be folded into a wider system, the Article 26 ter internal control bodies are the recognised recipients, and reporters must be protected from retaliation. The procedure does not replace the separate channel for reporting suspicious transactions under Article 18. Failing to approve and apply the procedures of Articles 26 and 26 bis is a serious infringement under Article 52.1.m).

The external route runs to Sepblac. Under Article 63, employees, directors and agents may report breaches to Sepblac in writing, with the documents that support the report. Entity training must cover these mechanisms. Under Article 64, Sepblac assesses the report and may ask for clarification. A report has no evidential value of its own, but it can lead to an inspection. Under Article 65, the report is confidential and the reporter’s data stays out of any sanctioning file. Since the amendment made by Ley 2/2023, anyone who suffers reprisals for reporting internally or to Sepblac may complain to the A.A.I.

8. Side by side

9. Group channels and EU branches

Under Article 11, the parent of a group adopts a general policy that applies across the group, which each company may adapt. The group may have one Responsable or one per company, and a single system, and Responsables may share information for coordination.

For a branch of an EU firm, the group route is the usual answer: one platform with a Spanish entry point. The Spanish duties still apply locally, and a group policy written for another member state rarely covers them without a local annex.

10. Worked case: a 20-person branch

Facts: the Spanish branch of a Luxembourg e-money institution has 20 staff. Its head office runs a group hotline in English and has never notified anyone in Spain.

What the rule says: the branch is caught by Article 10.1.b) whatever its size. The group system is allowed under Article 11, but the Spanish duties still apply. These are a home-page section in Spain, a notified Responsable, the Article 9 deadlines and a libro-registro.

What the compliance officer does: obtains a management-body decision naming the Responsable, checks which authority is competent and files the notice within ten working days. Adds a Spanish entry page, a local annex covering the Sepblac and A.A.I. routes, and a Spain register.

Outcome: a notified Spanish system instead of a foreign hotline nobody in Spain knew about.

11. Worked case: an AML breach reported anonymously

Facts: an anonymous report claims that onboarding staff are clearing high-risk customers without enhanced due diligence to hit volume targets.

What the rule says: this is an Article 26 bis matter, and it is also within Ley 2/2023 because it concerns EU AML law. Anonymous reports must be handled. The procedure must acknowledge within seven days where it can, investigate and reply within three months.

What the compliance officer does: logs the report, acknowledges it through the anonymous mailbox and restricts the file to the Responsable and the AML internal control body. Samples the onboarding files, records corrective action, checks whether any customer needs review under the separate Article 18 route, and replies in time.

Outcome: one file meets both laws, and the suspicious-transaction route stays separate, as Article 26 bis requires.

FAQ

12. What to do, today

• Management body: confirm in a minuted decision that the entity, or the branch, is under Article 10.1.b), and approve the policy and the procedure.
• Compliance: check that the Responsable notice was filed with the competent authority, and diary the ten-working-day rule for any change.
• Web team: add a separate channel section to the Spanish home page.
• MLRO: map Article 26 bis reports into the same workflow, with the Article 26 ter bodies as recipients and the Article 18 route kept apart.
• DPO: apply the three-month deletion rule, the ten-year ceiling and the Article 32 access list.

Related: What is Sepblac · Examen externo: the annual AML audit · Ley 10/2025 customer service and complaints